Systems and methods for controlling email access

ABSTRACT

Embodiments of the disclosure relate to proxying one or more email resources in transit to the client devices from the email services, removing one or more email attachments from the email resources, and encoding the stripped email attachments based at least in part on one or more cryptographic keys.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of application Ser. No. 15/664,279,filed Jul. 31, 2017, which is a continuation of Ser. No. 15/242,752,filed Aug. 22, 2016, which is a continuation of application Ser. No.14/337,338, filed Jul. 22, 2014, which is a continuation of applicationSer. No. 13/706,817, filed on Dec. 6, 2012, which is acontinuation-in-part of application Ser. No. 13/706,499, filed on Dec.6, 2012. The patent applications identified above are incorporatedherein by reference in their entireties.

FIELD OF THE INVENTION

Embodiments of the disclosure relate generally to data security, andmore particularly, to systems and methods for controlling email access.

BACKGROUND

Controlling email access is critical to ensure that email resources mayonly be accessed by authorized parties in authorized manners. To date,enterprises have utilized access credentials to control which, if any,parties may access email resources. This method may ensure that onlyauthorized parties may access email resources. However, this methodfails to control how those email resources may be accessed by the properrecipients. This method further fails to modify the email resources tocomply with enterprise security standards. As enterprises seek toprotect sensitive information, systems and methods for controlling emailaccess are necessary to ensure that email resources may only be accessedby authorized parties in authorized manners.

BRIEF SUMMARY

Some or all of the above needs and/or problems may be addressed bycertain embodiments of the disclosure. Certain embodiments may includesystems and methods for controlling access to networks. According to oneembodiment of the disclosure, there is disclosed a system. The systemcan include one or more client devices. The system can also include oneor more email services. The system can further include a memory thatstores computer-executable instructions. The system can yet furtherinclude a processor configured to access the at least one memory. Theprocessor is configured to execute the computer-executable instructionsto perform a method including the steps of proxying one or more emailresources in transit to the client devices from the email services,removing one or more email attachments from the email resources, andencoding the stripped email attachments based at least in part on one ormore cryptographic keys.

According to another embodiment of the disclosure, there is disclosed amethod. The method can include identifying, on one or more clientdevices, one or more encoded email resources, identifying one or morecryptographic keys associated with the encoded email resources, anddecoding the encoded email resources based at least in part on one ormore cryptographic keys.

Further, according to another embodiment of the disclosure, there isdisclosed a non-transitory computer-readable medium embodying a programexecutable in a computing device, the program comprising code that, whenexecuted by a computing device, causes the computing device to perform amethod comprising the steps of identifying one or more email resourcesassociated with one or more client devices, modifying one or moreportions of the email resources, and authorizing the client devicesassociated with the email resources to access the email resources.

Other embodiments, systems, methods, apparatus aspects, and features ofthe disclosure will become apparent to those skilled in the art from thefollowing detailed description, the accompanying drawings, and theappended claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The detailed description is set forth with reference to the accompanyingdrawings, which are not necessarily drawn to scale. The use of the samereference numbers in different figures indicates similar or identicalitems.

FIG. 1 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 2 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 1 according to certain embodiments of thepresent disclosure.

FIG. 3 illustrates a flow diagram of exemplary functionality performedby a client side application executed by a client device in thenetworked environment of FIG. 1 according to certain embodiments of thepresent disclosure.

FIGS. 4-5 are exemplary user interfaces rendered by an access controlservice executed by an access control server in the networkedenvironment of FIG. 1 according to certain embodiments of the presentdisclosure.

FIGS. 6-11 are exemplary user interfaces rendered by a client sideapplication executed by a client device in the networked environment ofFIG. 1 according to certain embodiments of the present disclosure.

FIG. 12 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 13 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 12 according to certain embodiments of thepresent disclosure.

FIG. 14 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 15 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 14 according to certain embodiments of thepresent disclosure.

FIG. 16 illustrates a flow diagram of exemplary functionality performedby a client side application executed by a client device in thenetworked environment of FIGS. 12 and 14 according to certainembodiments of the present disclosure.

FIG. 17 illustrates schematic block diagrams of an access control serverand a client device employed in the network environments of FIGS. 1, 12and 14 according to certain embodiments of the disclosure.

DETAILED DESCRIPTION

Illustrative embodiments of the disclosure will now be described morefully hereinafter with reference to the accompanying drawings, in whichsome, but not all embodiments of the disclosure are shown. Thedisclosure may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure will satisfy applicablelegal requirements. As noted above, like numbers refer to like elementsthroughout.

Illustrative embodiments of the disclosure are directed to, among otherthings, controlling access to email. As an overview, access to email maybe controlled by limiting access of proper recipients to specific emailresources and by limiting the manner in which the proper recipientsaccess the specific email resources. In certain embodiments, the emailresources may be modified to satisfy access restrictions.

The technical effects of certain embodiments of the disclosure mayinclude preventing unauthorized access to email resources andeliminating costs associated with sensitive information loss. Moreover,the technical effects of certain embodiments of the invention mayinclude modifying email resources to satisfy access restrictions.

FIG. 1 depicts certain illustrative components for a networkedenvironment 100 according to various embodiments. In certainembodiments, the networked environment 100 may include a network 110, aclient device 120, and an access control server 150. In someembodiments, the network 110 may be or include, for example, any type ofwireless network such as a wireless local area network (WLAN), awireless wide area network (WWAN), and/or the like. Additionally, thenetwork 110 may be or include the Internet, intranets, extranets,microwave networks, satellite communications, cellular systems, PCS,infrared communications, global area networks, and/or any combination oftwo or more such networks. In one embodiment, the network 110facilitates access to email resources 165 for one or more client devices120, where access to the email resources 165 is controlled by an accesscontrol server 150.

The client device 120 may comprise, for example, a cellular telephone, asmartphone and/or personal digital assistant, a tablet computer and/orweb pad, a laptop computer, a desktop computer, a set-top box, a musicplayer, a game console, and/or another device with like capability. Forpurposes of convenience, the client device 120 is referred to herein inthe singular. Even though the client device 120 is referred to in thesingular, it is understood that one or more client devices 120 may beemployed in the arrangements as descried herein.

The client device 120 may include a wired network connectivity component(not shown in FIG. 1), for example, an Ethernet network adapter, amodem, and/or the like. The client device 120 may further include awireless network connectivity interface (not shown in FIG. 1), forexample, a PCI (Peripheral Component Interconnect) card, USB (UniversalSerial Bus) interface, PCMCIA (Personal Computer Memory CardInternational Association) card, SDIO (Secure Digital Input-Output)card, NewCard, Cardbus, a modem, a wireless radio transceiver, and/orthe like. The client device 120 may be operable to communicate via wiredconnection with the access control server 150 with the aid of the wirednetwork connectivity component. The client device 120 may be furtheroperable to communicate wirelessly with the access control server 150with the aid of the wireless network connectivity component.

The client device 120 may comprise a memory for storing data andapplications, a processor for executing applications stored in memory, adisplay 136 upon which the processor may execute one or more userinterfaces 137, and a local interface such as a bus, as will bedescribed with respect to FIG. 12. The memory of the client device 120may comprise a data store 122. The data store 122 of the client device120 may include a device profile 123. In one embodiment, the deviceprofile 123 may represent hardware, software, and security attributesthat describe the state of the client device 120. For instance, thedevice profile 123 may represent hardware specifications of the clientdevice 120, version and configuration information of various softwareprograms and hardware components installed on the client device 120,transport protocols enabled on the client device 120, version and usageinformation of various other resources stored on the client device 120,and/or any other attributes associated with the state of the clientdevice 120. In another embodiment, the device profile 123 may furtherinclude characteristics describing the state of the client device 120,including indications of the location of the client device 120, thecurrent time associated with the client device 120, the client device's120 detection of one or more network beacons associated with one or morenetworks 110, and the signal strength of the network beacons received bythe client device 120. In yet another embodiment, the device profile 123may include data indicating a date of a last virus scan of the clientdevice 120, a date of a last access and/or service by an InformationTechnology (IT) representative, a date of a last access by an accesscontrol service 174, and/or any other data indicating a date of lastmaintenance of the client device 120.

Additionally, the data store 122 of the client device 120 may includeone or more user identifiers 132. The user identifiers 132 may uniquelyidentify the user of the client device 120. In one embodiment, the useridentifiers 132 may include a username, a password, and/or biometricdata related to facial recognition, retina recognition, fingerprintrecognition, and the like. Similarly, the data store 122 of the clientdevice 120 may include one or more device identifiers 135. The deviceidentifiers 132 may uniquely identify the client device 120. In oneembodiment, the device identifiers 135 may be a unique hardwareidentifier such as a GUID (Globally Unique Identifier), UUID(Universally Unique Identifier), UDID (Unique Device Identifier), serialnumber, IMEI (Internationally Mobile Equipment Identity), Wi-Fi MAC(Media Access Control) address, Bluetooth MAC address, a CPU ID, and/orthe like, or any combination of two or more such hardware identifiers.In another embodiment, the device identifier 135 may be a uniquesoftware identifier such a token or certificate, based at least in parton the aforementioned unique hardware identifiers.

The client device 120 may be configured to execute various applications.For example, the client device 120 may be configured to executeapplications such as secure container applications, web browsingapplications, email applications, instant messaging applications, wordprocessing applications and/or other applications capable of receivingand/or rendering resources 165 on a display 136 associated with theclient device 120. Any application capable of receiving and/or renderingresources 165 on a display 136 of the client device 120 is generallyreferred to herein as a “client side application” 126. The client sideapplication 126 may be stored in the memory of the client device 120. Inone embodiment, the client side application 126 may be a securecontainer application that may be authorized to receive and renderresources 165 in accordance with one or more resource rules 171, asdescribed herein. The client side application 126 may include acryptographic key to decrypt email resources 165 encrypted with acryptographic key in order to prevent unauthorized access to the emailresources 165. For instance, the client side application 126 may have acryptographic key that may be capable of decrypting email resources 165transmitted in an encrypted format to the client device 120 by an accesscontrol service 174 executed by an access control server 150.

The client side application 126 may be executed to transmit one or morerequests 177 to access one or more email resources 165. In certainembodiments, the client side application 126 may transmit requests 177to an access control service 174. In some embodiments, the requests 177may include a listing of specific email resources 165 the client device120 seeks to access. In other embodiments, the requests 177 may includean indication that the client device 120 seeks access to email resources165 associated with the client device 120, such as email resources 165addressed to the user of the client device 120. In any instance, therequests 177 may include data from the data store 122 of the clientdevice 120 that may assist an access control service 174 in determiningwhether the client device 120 is authorized to access the emailresources 165. In one embodiment, the request 177 may include the deviceprofile 123 associated with the client device 120. In anotherembodiment, the request 177 may include user identifiers 132 associatedwith the client device 120. In yet another embodiment, the request 177may include device identifiers 135 associated with the client device120.

The client side application 126 may be further executed to receive anindication that the client device 120 is authorized to access the emailresources 165. In certain embodiments, the client side application 126may receive an authorization indication from an access control service174 executed by an access control server 150. In some embodiments, theauthorization indication may specify which, if any, email resources 165that the client device 120 is authorized to access and may specify themanner in which the client device 120 may access such email resources165. In one embodiment, the authorization indication may specify thatthe client device 120 is authorized to access the email resources 165while the client device 120 is located within one or more authorizedlocations. In another embodiment, the authorization indication mayspecify that the client device 120 is authorized to access the emailresources 165 while the current time associated with the client device120 is within one or more authorized windows. In yet another embodiment,the authorization indication may specify that the client device 120 isauthorized to access the email resources 165 while the client device 120is communicatively connected to one or more networks 110 and/or one ormore network beacons associated with the networks 110, as described inapplication Ser. No. 13/656,046 entitled “SYSTEMS AND METHODS FORCONTROLLING NETWORK ACCESS,” which is incorporated herein by referencein the entirety.

The client side application 126 may be further executed to receive oneor more email resources 165. In certain embodiments, the client sideapplication 126 may receive email resources 165 from an access controlservice 174 executed by an access control server 150. In someembodiments, the client side application 126 may receive email resources165 from an enterprise email service, such as Microsoft Exchange, LotusNotes, Novell Groupwise, Zimbra, or the like. In other embodiments, theclient side application 126 may receive email resources 165 from adistribution service executed by a distribution server, as described inapplication Ser. No. 13/396,356 and Ser. No. 13/623,627 both entitled“CONTROLLING DISTRIBUTION OF RESOURCES ON A NETWORK,” which areincorporated herein by reference in their entirety.

In any instance, the email resources 165 may include various types ofelectronic data, such as email messages and email attachments. Incertain embodiments, the email messages may include text and/orformatting in email headers, email sender fields, email recipientfields, email subject fields, email bodies, email signatures, and/oremail footers. Additionally, the email attachments may includesettings-type attachments, applications-type attachments, andcontent-type attachments. In one embodiment, settings-type attachmentsmay include hardware settings, software settings, and/or the like thatconfigure the functionality provided by the client device 120. Inanother embodiment, application-type attachments may include bookapplications, business applications, catalogue applications, educationapplications, entertainment applications, finance applications, food anddrink applications, games applications, health and fitness applications,lifestyle applications, medical applications, music applications,navigation applications, news applications, newsstand applications,photo and video applications, productivity applications, referenceapplications, social networking applications, sports applications,travel applications, utility applications, weather applications, and/orthe like. In yet another embodiment, content-type attachments mayinclude application content, video content, image content, audiocontent, text content, word processor content, presentation content,spreadsheet content, database content, compressed folder content, diskimage content, encoded content, backup content, web content, page layoutcontent, plug-in content, font content, system content, developercontent, data content and/or the like.

The client side application 126 may be similarly executed to receive oneor more resource rules 171 associated with the email resources 165. Incertain embodiments, the resource rules 171 may regulate user of and/oraccess to the email resources 165. In some embodiments, the resourcerules 171 may include format rules, content rules, attachment rules,and/or access rules. In one embodiment, the format-type resource rules171 may specify one or more of required, permitted, and/or prohibitedformats of the email resources 165. For example, a format-type resourcerule 171 may specify that all email resources 165 must be encoded withAES-256 bit encryption. In another embodiment, the content-type resourcerules 171 may specify one or more of required, permitted, and/orprohibited content of the email resources 165. For instance, acontent-type resource rule 171 may specify that any email resources 165containing the text “confidential” must be transmitted utilizing asecure transmission protocol, such as the HTTPS/SSL transmissionprotocol. In yet another embodiment, the attachment-type resource rules171 may specify one or more of required, permitted, and/or prohibitedattachments to the email resources 165. For example, an attachment-typeresource rule 171 may specify that attachments to the email resources165 must be stripped from the email resources 165. In yet a furtherembodiment, the access-type resource rules 171 may specify one or moreof required, permitted, and/or prohibited access to the email resources165. For instance, an access-type resource rule 171 may specify that theemail resources 165 must be configured to be exclusively accessible viaa secure container application, such as the client side application 126.Furthermore, the various types of resource rules 171 may be combined toestablish granular access rights. For example, a combination of resourcerules 171 may specify required attachment format, attachment content,and attachment access.

In some embodiments, the resource rules 171 may be metadata and/or otherindications that describe the email resources 165. In particular, theresources rules 171 may specify categories/sub-categories to which theemail resources 165 belong, that the email resources 165 are consideredfavorites, the ownership of the email resources 165, the managing partyof the email resources 165, that the email resources 165 areconfidential, that the email resources 165 are password protected, thehistorical version of the email resources 165, one or more descriptionsof the email resources 165, one or more comments regarding the emailresources 165, the size and format of the email resources 165, thedownload priority associated with the email resources 165, an expirationdate associated with the email resources 165, one or more effectivedates associated with the email resources 165, and/or the like.

In other embodiments, the resource rules 171 associated with the emailresources 165 may change based on the state of the client device 120. Incertain embodiments, the stringency of the resource rules 171 may beincreased, reduced, and/or eliminated based on the state of the clientdevice 120. In one embodiment, the stringency of the resource rules 171may be increased, reduced, and/or eliminated if the client device 120 islocated within the transmission range of certain network beacons and/orcertain networks 110 associated with such network beacons. In anotherembodiment, the stringency of the resource rules 171 may be increased,reduced, and/or eliminated if the client device 120 is located withinone or more locations. In yet another embodiment, the stringency of theresource rules 171 may be increased, reduced, and/or eliminated if thecurrent time associated with the client device 120 is within one or moretime windows. In yet a further embodiment, the stringency of theresource rules 171 may be increased, reduced, and/or eliminated if theclient device 120 has previously satisfied the resource rules 171.

Additionally, the client side application 126 may be executed todetermine whether the client device 120 is authorized to access theemail resources 165. In certain embodiments, the client side application126 may determine whether the resource rules 171 associated with theemail resources 165 are satisfied by the email resources 165. Forinstance, the client side application 126 may determine that the clientdevice 120 is authorized to access the email resources 165 if theattachments to the email resources 165 have been stripped from the emailresources 165 in accordance with the resource rules 171 associated withthe email resources 165, which specify that the email resources 165 maynot have attachments. In some embodiments, the client side application126 may determine whether the client device is authorized based at leastin part on one or more of the device profile 123, user identifiers 132,or device identifiers 135.

The client side application 126 may be further executed to modify theemail resources 165. In certain embodiments, the client side application126 may modify the email resources 165 in response to a determinationthat the email resources 165 do not satisfy the resource rules 171associated with the email resources 165. In particular, the client sideapplication 126 may modify the email resources 165 so that the emailresources 165 satisfy the resource rules 171 associated with the emailresources 165. In some embodiments, the client side application 126 maymodify one or more portions of the email resources 165. In otherembodiments, the client side application 126 may modify all portions ofand/or the entirety of the email resources 165.

In any instance, the client side application 126 may modify the emailresources 165 by formatting, encoding, configuring, adding, removing,stripping, moving, replacing and/or flagging portions of the emailresources. In one embodiment, the client side application 126 may modifythe email resources 165 by formatting the email resources 165 intoHyperText Markup Language (HTML), Rich Text, Plain Text, and/or otherformats. In another embodiment, the client side application 126 maymodify the email resources 165 by encoding the email resources 165 usingAdvanced Encryption Standard (AES), Data Encryption Standard (DES),and/or other encryption protocols. In yet another embodiment, the clientside application 126 may modify the email resources 165 by configuringthe email resources 165 to be exclusively accessible via one or moresecure container applications, such as the client side application 126.In yet a further embodiment, the client side application 126 may modifythe email resources 165 by adding portions to and/or or removingportions from the email resources 165, for instance, by adding orremoving an email signature.

Additionally, in an exemplary embodiment, the client side application126 may modify the email resources 165 by removing portions of the emailresources 165 and configuring the removed portions of the emailresources 165 to be exclusively accessible via a secure containerapplication, such as the client side application 126. For example, theclient side application 126 may remove attachments from the emailresources 165 and may encode the removed attachments based at least inpart on one or more cryptographic keys accessible to the client sideapplication 126. In another embodiment, the client side application 126may modify the email resources 165 by performing one or more ofdecrypting the email resources 165, re-encrypting the email resources165, cryptographically signing email resources 165, or re-signing emailresources 165. In yet another embodiment, the client side application126 may modify the email resources 165 by moving certain portions of theemail resources 165, such as by moving a photograph from the body of theemail resources 165 to the attachments of the email resources 165. Inyet a further embodiment, the client side application 126 may modify theemail resources 165 by replacing certain portions of the email resources165, such as replacing misspelled text with the properly spelled text.In even yet a further embodiment, the client side application 126 maymodify the email resources 165 by flagging the email resources 165 ashaving been modified, such as by attaching an indication to the emailresources 165 that provides information related to the modification ofthe email resources 165.

The client side application 126 may be yet further executed to accessone or more email resources 165. In certain embodiments, the client sideapplication 126 may access the email resources 165 received from anaccess control service 174 and/or another distribution service. In someembodiments, the client side application 126 may access the emailresources 165 on the client device 120 in accordance with the resourcerules 171. For example, the client side application 126 may determinethat the email resources 165 may not be accessed by the client device120 because the client device 120 is not located within an authorizedlocation specified by the resource rules 171 associated with the emailresources 165.

In any instance, the client side application 126 may access the emailresources 165 on the client device 120 by storing, installing,activating, rendering and/or executing the email resources 165 on theclient device 120. In one embodiment, the client side application 126may store the email resources 165 on the client device 120 by placingthe email resources 165 in the data store 122 of the client device 120.In another embodiment, the client side application 126 may install theemail resources 165 on the client device 120 by placing the emailresources 165 in the data store 122 of the client device 120 and bydisabling and/or removing any files that conflict with the emailresources 165. In yet another embodiment, the client side application126 may activate the email resources 165 on the client device 120 byplacing the email resources 165 in the data store 122 of the clientdevice 120, by disabling and/or removing any files that conflict withthe email resources 165, and by instructing the client device 120 toconform its operations to the email resources 165. Additionally, theclient side application 126 may call on other applications and/orservices accessible to the client device 120 that are associated withthe email resources 165.

In yet a further embodiment, the client side application 126 may renderthe email resources 165 on the client device 120 by presenting the emailresources 165 in a user interface 137 executed on the display 136 of theclient device 120. In particular, the client side application 126 mayrender the email resources 165 in a user interface 137 by decompressingcompressed files and presenting the uncompressed files, mounting diskimage files and presenting the mounted image files, running executablefiles and presenting the executed files, by enabling a data search ofthe email resources 165 and presenting the featured output in a userinterface 137, by calling on another application on the client device120 to respond to data links contained within the email resources 165,and/or by transmitting a part or the whole of the email resources 165 toanother application on the client device 120. The client sideapplication 126 may render a single email resource 165 or a series ofemail resources 165 in a comprehensive manner, such as presenting imagefiles in a slideshow-style presentation, and may further render anenvironment that displays an array of email resources 165 in a singleview, such as a category-based tree or outline format. Additionally, inan exemplary embodiment, the client side application 126 may execute theemail resources 165 by placing the email resources 165 in the data store122 of the client device 120, by disabling and/or removing any filesthat conflict with the email resources 165, and by instructing theclient device 120 to perform the operations of the email resources 165.

In certain embodiments, the client side application 126 may be a securecontainer application that is configured to protect the email resources165 from unauthorized access. In some embodiments, the client sideapplication 126 may be configured to protect email resources 165 thathave been received from an access control service 174. In oneembodiment, the client side application 126 may be executed to enforcethe resource rules 171 and/or other metadata associated with the emailresources 165. For instance, the client side application 126 mayprohibit cutting, copying, pasting, transmitting, emailing, textmessaging, screen capturing, and/or otherwise manipulating the emailresources 165 while the email resources 165 are accessed by the clientside application 126. In another embodiment, the client side application126 may prohibit other applications on the client device 120 and/orother services accessible to the client device 120 from accessing theemail resources 165. In particular, the client side application 126 maymonitor the data stream between the network 110 and the client device120, may block any access attempts by another application and/orservice, may proxy the email resources 165, and may present the proxyiedemail resources 165 in a user interface 137 rendered by the client sideapplication 126.

The access control server 150 may comprise, for example, a servercomputer or any other system providing access control capability.Alternatively, a plurality of access control servers 150 may be employedthat are arranged, for example, in one or more server banks or computerbanks or other arrangements. For example, a plurality of access controlservers 150 together may comprise a cloud computing resource, a gridcomputing resource, and/or any other distributed computing arrangement.Such access control servers 150 may be located in a single installationor may be distributed among many different geographic locations. Forpurposes of convenience, the access control server 150 is referred toherein in the singular. Even though the access control server 150 isreferred to in the singular, it is understood that a plurality of accesscontrol servers 150 may be employed in the arrangements as descriedherein.

The access control server 150 may comprise a memory for storing data andapplications and a processor for executing applications stored inmemory, as will be described with respect to FIG. 12. The memory of theaccess control server 150 may comprise a data store 153. The data store153 may be representative of one or more data stores. The data store 153may contain certain data that is accessible to the access control server150. In particular, the data store 153 may contain one or more emailresources 165 and one or more resource rules 171 associated with theemail resources 165, as described herein. The data in the data store 153may be associated with the operation of certain applications and/orfunctionalities executed by the access control server 150. The datastore 153 may utilize strong encryption standards to protect the emailresources 165 from unauthorized access. For example, the data store 153may utilize AES (Advanced Encryption Standard) or a similar strongencryption standard commonly utilized for server-side data storage.

The access control server 150 may execute certain applications and/orfunctionalities such the access control service 174, as well as otherapplications, services, processes, systems, engines, or functionalitynot disclosed in detail herein. The access control service 174 may beexecuted to control email access. In particular, the access controlservice 174 may limit access to one or more email resources 165 to oneor more client devices 120 that are authorized to access the emailresources 165. The access control service 174 may be further executed tomodify one or more email resources 165 so that the email resources 165satisfy one or more resource rules 171 associated with the emailresources 165. The access control service 174 may yet be furtherexecuted to distribute one or more email resources 165 to one or moreclient devices 120 that are authorized to access the email resources165.

The access control service 174 may be executed to control access to oneor more email resources 165. In certain embodiments, the access controlservice 174 may be executed to determine whether one or more clientdevices 120 are authorized to access the email resources 165. In someembodiments, the client side application 126 may determine whether theresource rules 171 associated with the email resources 165 are satisfiedby the email resources 165. For instance, the access control service 174may determine that a client device 120 is authorized to access the emailresources 165 if the attachments to the email resources 165 have beenstripped from the email resources 165 in accordance with the resourcerules 171, which specify that the email resources 165 may not haveattachments. In other embodiments, the access control service 174 maydetermine whether the client device is authorized based at least in parton one or more of the device profile 123, user identifiers 132, ordevice identifiers 135.

The access control service 174 may be further executed to modify theemail resources 165 to satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the access controlservice 174 may modify the email resources 165 in response to adetermination that the email resources 165 do not satisfy the resourcerules 171 associated with the email resources 165. In particular, theaccess control service 174 may modify the email resources 165 so thatthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In some embodiments, the access control service174 may modify one or more portions of the email resources 165. In otherembodiments, the access control service 174 may modify all portions ofand/or the entirety of the email resources 165.

In any instance, the access control service 174 may modify the emailresources 165 by formatting, encoding, configuring, adding, removing,stripping, moving, replacing or flagging portions of the emailresources. In one embodiment, the access control service 174 may modifythe email resources 165 by formatting the email resources 165 intoHyperText Markup Language (HTML), Rich Text, Plain Text, and/or otherformats. In another embodiment, the access control service 174 maymodify the email resources 165 by encoding the email resources 165 usingAdvanced Encryption Standard (AES), Data Encryption Standard (DES),and/or other encryption protocols. In yet another embodiment, the accesscontrol service 174 may modify the email resources 165 by configuringthe email resources 165 to be exclusively accessible via one or moresecure container applications, such as a client side application 126. Inyet a further embodiment, the access control service 174 may modify theemail resources 165 by adding portions to and/or or removing portionsfrom the email resources 165, for instance, by adding or removing anemail signature.

Additionally, in an exemplary embodiment, the access control service 174may modify the email resources 165 by removing portions from the emailresources 165 and configuring the removed portions of the emailresources 165 to be exclusively accessible via a secure containerapplication, such as the client side application 126. For example, theaccess control service 174 may remove attachments to the email resources165 from the email resources 165, may encode the removed attachmentsbased at least in part on one or more cryptographic keys, and may makethe removed attachments and cryptographic keys accessible to the clientside application 126. In another embodiment, the access control service174 may modify the email resources 165 by performing one or more ofdecrypting the email resources 165, re-encrypting the email resources165, cryptographically signing email resources 165, or re-signing emailresources 165. In yet another embodiment, the access control service 174may modify the email resources 165 by moving certain portions the emailresources 165, such as by moving a photograph from the body of the emailresources 165 to the attachments of the email resources 165. In yet afurther embodiment, the access control service 174 may modify the emailresources 165 by replacing certain portions of the email resources 165,such as replacing misspelled text with the properly spelled text. Ineven yet a further embodiment, the access control service 174 may modifythe email resources 165 by flagging the email resources 165 as havingbeen modified, such as attaching an indication to the email resources165 that provides information related to the modification of the emailresources 165.

The access control service 174 may be yet further executed to transmitone or more email resources 165 to one or more client devices 120. Incertain embodiments, the access control service 174 may transmit theemail resources 165 to the client devices 120 responsive to adetermination that the client devices 120 are authorized to access theemail resources 165. In some embodiments, the access control service 174may transmit the email resources 165 to the client devices 120responsive to modifying the email resources 165 to satisfy the resourcerules 171 associated with the email resources 165. In one embodiment,the access control service 174 may directly transmit the email resources165 to a client side application 126 executed by the client devices 120.In another embodiment, the distribution service 174 may make the emailresources 165 available for download by the client devices 120 and maytransmit the email resources 165 to the client devices 120 uponreceiving requests 177 to download the email resources 165 from theclient devices 120. In any instance, the access control service 174 mayestablish a communicative connection with the client devices 120 byutilizing a secure transmission protocol, such as HTTPS/SSL, beforetransmitting the email resources 165 to the client devices 120.

FIG. 2 is a flowchart illustrating exemplary functionality performed byan access control service 174 executed by an access control server(FIG. 1) according to certain embodiments. It is understood that theflowchart of FIG. 2 provides merely an example of the many differenttypes of functional arrangements that may be employed to implement theoperation of the access control service 174 as described herein. As analternative, the flowchart of FIG. 2 may be viewed as depicting anexample of steps of a method implemented in the access control server150 according to one or more embodiments.

Beginning with step 203, the access control service 174 may identify oneor more email resources 165. In certain embodiments, the access controlservice 174 may identify one or more email resources 165 associated withone or more client devices 120. In one embodiment, the email resources165 may be associated with the client devices 120 if the email resources165 are addressed to the client devices 120 and/or the users of theclient devices 120. For instance, the email resources 165 may beaddressed to the client devices 120 and/or the users of the clientdevices 120 if the identities of the client devices 120 and/or the usersof the client devices 120 are specified within the email headers, emailsender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, and/oremail footers of the email resources 165. In another embodiment, theemail resources 165 may be associated with the client devices 120 if theemail resources 165 are accessible to the client devices 120, forinstance, via one or more user identifiers, one or more deviceidentifiers, and/or one or more device profiles associated with theclient devices 120. In yet another embodiment, the email resources 165may be associated with the client devices 120 according to a listing ofassociated email resources 165 and client devices 120. In any instance,the email resources 165 may include email messages, email attachments,and/or other electronic data, as described herein.

Next, in step 206, the access control service 174 may identify one ormore resource rules 171. In certain embodiments, the access controlservice 174 may identify one or more resource rules 171 associated withone or more email resources 165. In some embodiments, a given resourcerule 171 may be associated with one or more email resources 165 and,similarly, a given email resource 165 may be associated with one or moreresource rules 171. In one embodiment, the resource rules 171 may beassociated with the email resources 165 if the resource rules 171 areembedded within the email headers, email bodies, email signatures,and/or email footers of the email resources 165. In particular, theemail resources 165 may include embedded metadata and/or otherinstructions that represent one or more resource rules 171. In anotherembodiment, the resource rules 171 may be associated with the emailresources 165 if the resource rules 171 are affixed to the emailresources 165, such as attachments to the email resources 165. In yetanother embodiment, the resource rules 171 may be associated with theemail resources 165 according to a listing of associated email resources165 and resource rules 171. In any instance, the resource rules 171 mayregulate access to the email resources 165 associated with the resourcerules 171 by the client devices 120 associated with the email resources165, as described herein.

Then, in step 209, the access control service 174 may determine whetherthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the access controlservice 174 may determine that the client devices 120 associated withthe email resources 165 are authorized to access the email resources 165if the email resources 165 satisfy the associated resources rules 171.In any instance, the access control service 174 may determine whetherthe state of the email resources 165 satisfies the requirementsspecified by the associated resource rules 171. In particular, theaccess control service 174 may determine whether the email headers,email sender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, emailfooters, and/or email attachments of the email resources 165 satisfy theassociated resource rules 171, as described herein.

If the access control service 174 determines that the email resources165 do not satisfy the resource rules 171, then the access controlservice 174 may proceed to step 212 and may modify the email resources165. In certain embodiments, the access control service 174 may modifythe email resources 165 so that the email resources 165 satisfy theresource rules 171 associated with the email resources 165. In someembodiments, the access control service 174 may modify one or moreportions of the email resources 165. In other embodiments, the accesscontrol service 174 may modify all portions of and/or the entirety ofthe email resources 165. In any instance, the access control service 174may modify the email resources 165 by formatting, encoding, configuring,adding, removing, stripping, moving, replacing and/or flagging portionsof the email resources 165, as described herein.

On the contrary, if the access control service 174 determines that theemail resources 165 satisfy the resource rules 171, then the accesscontrol service 174 may proceed to step 215 and may authorize the clientdevices 120 to access the email resources 165. In certain embodiments,the access control service 174 may authorize the client devices 120 toaccess the email resources 165 by transmitting the email resources 165to one or more client side applications 126 executed by the clientdevices 120. In some embodiments, the access control service 174 mayauthorize the client devices 120 to access the email resources 165 bynotifying the client devices 120 that the email resources 165 may bedownloaded from the access control service 174 and may further transmitthe email resources 165 to the client devices 120 upon a request 177. Inany instance, the access control service 174 may authorize the clientdevices 120 to access the email resources 165 by providing the clientdevices 120 with a means of accessing the email resources 165. In oneembodiment, the access control service 174 may authorize the clientdevices 120 to access one or more unmodified email resources 165. Inanother embodiment, the access control service 174 may authorize theclient devices 120 to access one or more email resources 165 that havebeen modified by the access control service 174 so that the emailresources 165 satisfy the resource rules 171 associated with the emailresources 165.

FIG. 3 is a flowchart illustrating exemplary functionality performed bya client side application 126 executed by a client device 120 (FIG. 1)according to certain embodiments. It is understood that the flowchart ofFIG. 3 provides merely an example of the many different types offunctional arrangements that may be employed to implement the operationof the client side application 126 as described herein. As analternative, the flowchart of FIG. 3 may be viewed as depicting anexample of steps of a method implemented in the client device 120according to one or more embodiments.

Beginning with step 303, the client side application 126 may transmitone or more requests 177 to access one or more email resources 165. Incertain embodiments, the client side application 126 may transmitrequests 177 to an access control service 174. In some embodiments, therequests 177 may include a listing of specific email resources 165 thatthe client device 120 seeks to access. In other embodiments, therequests 177 may include an indication that the client device 120 seeksaccess to email resources 165 associated with the client device 120,such as email resources 165 addressed to the user of the client device120. In any instance, the requests 177 may include data from the datastore 122 of the client device 120, such as device profiles 123, useridentifiers 132, and device identifiers 135 associated with the clientdevice 120, as described herein.

Next, in step 306, the client side application 126 may receive one ormore email resources 165. In certain embodiments, the client sideapplication 126 may receive one or more email resources 165 from anaccess control service 174 executed by an access control server 150. Inone embodiment, the client side application 126 may directly receive theemail resources 165 from the access control service 174. In anotherembodiment, the client side application 126 may receive one or moreindications from the access control service 174 that specify that theemail resources 165 are available for download from the access controlservice 174. In such embodiment, the client side application 126 mayrequest to download the email resources 165 from the access controlservice 174 in response to receiving an indication that the emailresources 165 are available for download from the access control service174. In some embodiments, the client side application 126 may receiveone or more email resources 165 from an enterprise email service, suchas Microsoft Exchange or Lotus Notes, or from a distribution serviceexecuted by a distribution server, as described herein.

Then, in step 309, the client side application 126 may identify one ormore resource rules 171. In certain embodiments, the client sideapplication 126 may identify one or more resource rules 171 associatedwith one or more email resources 165. In some embodiments, the resourcerules 171 may be associated with multiple email resources 165 and theemail resources 165 may be associated with multiple resource rules 171,as described herein. In one embodiment, the resource rules 171 may beassociated with the email resources 165 if the resource rules 171 areembedded within the email headers, email bodies, email signatures,and/or email footers of the email resources 165. In particular, theemail resources 165 may include embedded metadata and/or otherinstructions that represent one or more resource rules 171. In anotherembodiment, the resource rules 171 may be associated with the emailresources 165 if the resource rules 171 are affixed to the emailresources 165, such as attachments to the email resources 165. In yetanother embodiment, the resource rules 171 may be associated with theemail resources 165 according to a listing of associated email resources165 and resource rules 171. In any instance, the resource rules 171 mayregulate access to the email resources 165 associated with the resourcerules 171 by the client devices 120 associated with the email resources165, as described herein.

Next, in step 312, the client side application 126 may determine whetherthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the client sideapplication 126 may determine that the client device 120 associated withthe email resources 165 is authorized to access the email resources 165if the email resources 165 satisfy the associated resources rules 171.In any instance, the client side application 126 may determine whetherthe state of the email resources 165 satisfies the requirementsspecified by the associated resource rules 171. In particular, theclient side application 126 may determine whether the email headers,email sender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, emailfooters, and/or email attachments of the email resources 165 satisfy theassociated resource rules 171, as described herein.

If the client side application 126 determines that the email resources165 do not satisfy the resource rules 171, then the client sideapplication 126 may proceed to step 315 and may modify the emailresources 165. In certain embodiments, the client side application 126may modify the email resources 165 so that the email resources 165satisfy the resource rules 171 associated with the email resources 165.In some embodiments, the client side application 126 may modify one ormore portions of the email resources 165. In other embodiments, theaccess control service 174 may modify all portions of and/or theentirety of the email resources 165. In any instance, the client sideapplication 126 may modify the email resources 165 by formatting,encoding, configuring, adding, removing, stripping, moving, replacingand/or flagging portions of the email resources 165, as describedherein.

On the contrary, if the client side application 126 determines that theemail resources 165 satisfy the resource rules 171, then the client sideapplication 126 may proceed to step 318 and may authorize the clientdevice 120 to access the email resources 165. In certain embodiments,the client side application 126 may authorize the client device 120 toaccess the email resources 165 by providing the client devices 120 witha means of accessing the email resources 165. For example, the clientside application 126 may enable storing, installing, activating,rendering and/or executing the email resources 165 on the client device120, as described herein. In one embodiment, the client side application126 may authorize the client device 120 to access one or more unmodifiedemail resources 165. In another embodiment, the client side application126 may authorize the client device 120 to access one or more emailresources 165 that have been modified by the access control service 174so that the email resources 165 satisfy the resource rules 171associated with the email resources 165. In yet another embodiment, theclient side application 126 may authorize the client device 120 toaccess one or more email resources 165 that have been modified by theclient side application 126 so that the email resources 165 satisfy theresource rules 171 associated with the email resources 165.

FIG. 4 is an example of a user interface 137 a that allows anadministrator of an access control service 174 (FIG. 1) to associate oneor more resource rules 171 (FIG. 1) with one or more email resources 165(FIG. 1). In certain embodiments, the user interface 137 a may include agrouping view field 402, a rules view field 404, an add rules button406, one or more rules description fields 408, one or more actionbuttons 410, and one or more defined rules 412.

The grouping view field 402 may allow the administrator to select agroup of client devices 120 and/or a group of users of client devices120 to manage. For example, the administrator may manipulate theresource rules 171 that apply to the “Enterprise” group of clientdevices 120 by selecting the “Enterprise” grouping from the pull-downprovided by the grouping view field 402. The rules view field 404 mayallow the administrator to filter the resource rules 171 to manage. Forinstance, the administrator may filter the resource rules 171 by eitherselecting the “All Email Rules” set of resource rules 171 or the “ActiveEmail Rules” set of resource rules 171 from the options provided by therules view field 404.

The add rules button 406 may allow the administrator to add new resourcerules 171 to the collection of resource rules 171 that apply to the“Enterprise” group of client devices 120. For example, invoking the addrules button 406 may instruct the access control service 174 to provideanother user interface 137 in which the administrator may define one ormore new resource rules 171, as will be described in FIG. 5. The rulesdescription fields 408 may specify one or more characteristics thatdescribe each of the resource rules 171. For instance, the rulesdescription fields 408 may include indications of whether a rule isactive 408 a, a name of a rule 408 b, a storage location of a rule 408c, a brief description of a rule 408 d, an assignment of a rule 408 e,an effective date and/or expiration date of a rule 408 f, and a lastmodified date of a rule 408 g. The action buttons 410 may allow anadministrator to take one or more actions to a resource rule 171, suchas editing the resource rule 171 and/or adjusting the settings of aresource rule 171. The defined rules 412 may include one or moreresource rules 171 that have been previously created by an administratorof the access control service 174, such as the “Encrypt EmailAttachments” rule 412 a and the “Remove Email Attachments” rule 412 b.

FIG. 5 is an example of a user interface 137 b that allows anadministrator of an access control service 174 (FIG. 1) to create one ormore new resource rules 171 (FIG. 1), which may provide and/or controlaccess to one or more applications and/or services accessible to one ormore client devices 120 (FIG. 1). In certain embodiments, the userinterface 137 b may include a rule type field 502, an access credentialsfield 504, an access rights field 506, and one or more action buttons508. In some embodiments, the access rights field 506 may include an“Encrypt All Attachments” button 506 a and a “Remove All Attachments”button 506 b.

The rule type field 502 may include one of more types of resource rules171 that may be created through the user interface 137 b. For example,an administrator of the access control service 174 may select “ExchangeActiveSync” from the rules type field 502 to create resource rules 171associated with email resources 165 (FIG. 1). The access credentialsfield 504 may include one or more fields that accept input of one ormore credentials for access to one or more applications and/or servicesaccessible to the client devices 120. For instance, an administrator ofthe access control service 174 may input the “Domain,” “Username,”“Email Address,” “Password,” and “Payload Certificates” associated withthe client devices 120. The access rights field 506 may include one ormore access rights that may be defined for the client devices 120, whichmay control access by client devices 120 to applications and/orservices. For example, an administrator of the access control service174 may apply one or more access restrictions including “Prevent MovingMessages,” “Prevent Use in 3^(rd) Party Apps,” “Disable recent contactsync,” “Encrypt All Attachments” 506 a, and “Remove All Attachments” 506b. The action buttons 508 may include one or more buttons that saveand/or delete the resource rules 171 defined in the user interface 137b. For example, an administrator of the access control service 174 mayinvoke the “Save” action button 508 to store the resource rules 171associated with the email resources 165 in the data store 153 (FIG. 1)of the access control server 150 (FIG. 1).

FIG. 6 is an example of a user interface 137 c executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be an applicationnative to the client device 120 that is capable of receiving and/orrendering email resources 165. For example, the client side application126 may be a native email application, such as Microsoft Outlook orApple Mail. The client side application 126 may include an emailselection field 602 and an email viewing pane 604. The email selectionfield 602 may include one or more email messages that may be selected toaccess within the email viewing pane 604. For example, the user of theclient device, such as “John Smith,” may select an email messageentitled “Confidential—Q3 2012 Revenue” sent to “John Smith” from“George Williams.” The email viewing pane 604 may include a senderfield, a recipient field, a title field, a body field, and one or moreattachments 606. For instance, the email viewing pane 604 may provide auser of a client device 120 to access the attachment entitled“PROTECTED: Q3 2012 Revenue.pdf.”

FIG. 7 is an example of a user interface 137 d executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be an applicationnative to the client device 120 that is capable of receiving and/orrendering email resources 165. For example, the client side application126 may be a native email application, such as Microsoft Outlook orApple Mail, as similarly described in FIG. 6. In some embodiments, theuser of the client device 120 may request to access the attachmententitled “PROTECTED: Q3 2012 Revenue.pdf” by selecting the attachment onthe user interface 137 d. In one embodiment, the attachment entitled“PROTECTED: Q3 2012 Revenue.pdf” may be associated with resource rules171 (FIG. 1) that specify that the email resources 165 may only beaccessed via a secure container application.

The user interface 137 d may provide an access selection field 702 toprovide the user of the client device 120 with one or more accessapplications and/or services that are available for accessing the emailresources 165 in accordance with the associated resource rules 171. Forexample, the access selection field 702 may specify that a client sideapplication 126 with secure container capabilities may be selected, aclient side application 126 with native email capabilities may not beselected, and a printing function of the client device 120 may not beselected. By selecting the client side application 126 with securecontainer capabilities from the access selection field 702, the currentclient side application 126 with native email capabilities may call onthe client side application 126 with secure container capabilities inorder to access the email attachment.

FIG. 8 is an example of a user interface 137 e executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be a secure containerapplication that is capable of receiving and/or rendering emailresources 165, as described herein. In some embodiments, the userinterface 137 e may provide an authentication form which must be filledout by the user of the client device 120 in order to gain access to oneor more email resources 165 accessible through the secure containerenvironment of the client side application 126. In particular, the userinterface 137 e may provide an authentication form that includes ausername field 802, a password field 804, and a login button 806. A userof the client device 120, such as “John Smith,” may provide a username,such as “John Smith,” in the username field 802, may provide a password,such as “ . . . ,” and may invoke the login button 806 to provide theaccess credentials to the client side application 126. Responsive to adetermination that the access credentials provided by the user of theclient device 120 are authorized, the client side application 126 mayprovide the user of the client device 120 with access to the securecontainer environment of the client side application 126.

FIG. 9 is an example of a user interface 137 f executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be a secure containerapplication that is capable of receiving and/or rendering emailresources 165, as described herein. The secure container environment ofthe client side application 126 may include a views pane 902, acategories pane 904, and action buttons 906. The views pane 902 mayinclude one or more views that are accessible to the user of the clientdevice 120, such as an “all content” view, a “new content” view, a“recent activity” view, and a “favorites” view. The user of the clientdevice 120 may select one of the available views, each of which mayinclude a subset of email resources 165 related to the certain view. Thecategories pane 904 may include one or more categories of emailresources 165 that are available to the user of the client device 120,such as an “Email Attachments” category that is a subset of an “EmailResources” category. The user of the client device 120 may, forinstance, select the “Email Attachments” category to access one or moreemail attachments that are configured to be accessible via the securecontainer environment of the client side application 126. The actionbuttons 906 may include a “Content” button, a “Downloads” button, a“Search” button, an “Updates” button, and a “Settings” button that maylaunch other user interfaces 137 provided by the client side application126 to enable additional views, applications, and/or services.

FIG. 10 is an example of a user interface 137 e executed by a clientside application 126 (FIG. 1) on a client device 120 (FIG. 1). Incertain embodiments, the client side application 126 may be a securecontainer application that is capable of receiving and/or renderingemail resources 165, as described herein. The secure containerenvironment of the client side application 126 may include an accessibleresource listing 1002 and an access notification 1004. The user of theclient device 120 may select an email resource 165, such an as emailattachment, from the accessible resource listing 1002. Responsive to theuser of the client device 120 selecting the “Q3 2012 Revenue.pdf” emailresource 165 from the accessible resource listing 1002, the client sideapplication 126 may provide the user with access to the email resource165 by unlocking the protected file. In particular, the email resource165 may have been encrypted with a symmetric cryptographic key and/or aasymmetric cryptographic key by an access control service 174 (FIG. 1)according to one or more resource rules 171 (FIG. 1) associated with theemail resource 165, as described herein. Consequently, the client sideapplication 126 may decrypt the email resource 165 to enable access tothe email resource 165 and may provide an access notification 1004 thatspecifies that the client side application 126 is “Unlocking (the)PROTECTED file” and to “Please Wait” to access the email resource 165while the client side application 126 unlocks the email resource 165.

FIG. 11 is an example of a user interface 137 e executed by a clientside application 126 (FIG. 1) on a client device 120 (FIG. 1). Incertain embodiments, the client side application 126 may be a securecontainer application that is capable of receiving and/or renderingemail resources 165, as described herein. The client side application126 may include a resource title pane 1102, a resource content pane 1104and a resource page selection pane 1106. The resource title pane 1102may specify the title of the email resources 165, such as “Q3 2012Revenue.” The resource content pane 1104 may include the body of theemail resources 165, such as the pages of the PDF file “Q3 2012Revenue.” The resource page selection pane 1106 may include one or morepages of the email resources 165. The user of the client device 120 may,for example, select a page from the resource page selection pane 1106.Responsive to the user of the client device 120 selecting a certain pagefrom the resource page selection pane 1106, the client side application126 may navigate to the selected page and present the content of theselected page in the resource content pane 1104.

FIG. 12 depicts certain illustrative components for a networkedenvironment 1200 according to various embodiments. In certainembodiments, the networked environment 1200 may include one or morenetworks 110, one or more client devices 120, an access control service174, and one or more email services 1202. The email services 1202 may beconfigured to provide the client devices 120 with access to one or moreemail resources 165 (FIG. 1) associated with the email services 1202. Asan example, the email services 1202 may be and/or include one or moreenterprise email services, such as Microsoft Exchange, Lotus Notes,and/or other services capable of distributing email resources 165 toclient devices 120. The access control service 174 may be configured toauthorize the client devices 120 to access to the email services 1202,may control the manner in which the client devices 120 are authorized toaccess the email services 1202, and may provide the client devices 120with access to the email services 1202.

In one embodiment, the access control service 174 may be configured toproxy email resources 165 provided to the client devices 120 by theemail services 1202. The access control service 174 may, for instance,filter all email resources 165 transmitted between the email services1202 and the client devices 120. Alternatively, the access controlservice 174 may proxy email resources 165 in transit to the clientdevices 120 from the email services 1202. In another embodiment, theaccess control service 174 may be configured to provide a gateway foraccess to the email services 1202. The access control service 174 may,for instance, provide authorized client devices 120 with access to theemail services 1202 and deny unauthorized client devices 120 fromaccessing the email services 1202.

In any instance, the access control service 174 may be configured todetermine whether the client devices 120 re authorized to access theemail resources 165. The access control service 174 may, for example,receive one or more requests 177 (FIG. 1) to access the email services1202 from the client devices 120. The access control service 174 maydetermine whether the client devices 120 associated with the requests177 are authorized to access the email services 1202 based on, forinstance, one or more device profiles 123 (FIG. 1), one or more useridentifiers 132 (FIG. 1), one or more device identifiers 135 (FIG. 1)associated with the client device 120, which may be included in therequests 177. The access control service 174 may provide the clientdevices 120 with access to the email services 1202 in response to adetermination that the client devices 120 are authorized to access theemail services 1202. In one embodiment, the access control service 174may establish a communicative connection between the email services 1202and the client devices 120, which may facilitate the transmission ofemail resources 165 between the email services 1202 and the clientdevices 120. In another embodiment, the access control service 174 mayestablish a communicative connection between the access control service174 and the client devices 120, which may facilitate the transmission ofemail resources 165 associated with the email service 1202 between theaccess control service 174 and the client devices 120.

Additionally, the access control service 174 may be configured tocontrol access to the email resources 165 by the client devices 120. Theaccess control service 174 may determine which email resources 165 theclient devices 120 are authorized to access. The access control service174 may also modify the email resources 165 before providing the clientdevices 120 with access to the email resources 165. In one embodiment,the access control service 174 may strip and/or remove one or more emailattachments from the email resources 165. In another embodiment, theaccess control service 174 may configure one or more email attachmentsto be exclusively accessible via one or more client side applications126 (FIG. 1) on the client devices 120. For example, the access controlservice 174 may transmit one or more cryptographic keys that may decodeone or more encoded portions of the email resources 165 to the clientside applications 126 on the client devices 120. In another embodiment,the access control service 174 may encode one or more email attachmentsto the email resources 165 before making the email attachmentsaccessible to the client devices 120. In yet a further embodiment, theaccess control service 174 may instruct the email services 1202 to stripand/or remove one or more email attachments from the email resources165, encode the email attachments based at least in part on one or morecryptographic keys, and configure the email attachments to beexclusively accessible via one or more client side applications 126 onthe client devices 120.

Furthermore, the access control service 174 may be configured to providethe client devices 120 with access to the email services 1202 and/or theemail resources 165 associated with the email services 1202. In oneembodiment, the access control service 174 may be configured to transmitemail resources 165 to the client devices 120. For example, the accesscontrol service 174 may establish a secure communicative connection withthe client devices 120, such as HTTPS/SSL, through which the accesscontrol service 174 may transmit the email resources 165 associated withthe email services 1202 to the client devices 120. In anotherembodiment, the access control service 174 may be configured to transmitinstructions to the email services 1202 that specify that the emailservices 1202 should transmit the email resources 165 to the clientdevices 120.

FIG. 13 is a flowchart illustrating exemplary functionality performed byan access control service 174 executed by an access control server 150(FIG. 1) according to certain embodiments. It is understood that theflowchart of FIG. 13 provides merely an example of the many differenttypes of functional arrangements that may be employed to implement theoperation of the access control service 174 as described herein. As analternative, the flowchart of FIG. 13 may be viewed as depicting anexample of steps of a method implemented in the access control server150 according to one or more embodiments.

Beginning with step 1302, an access control service 174 may proxy one ormore email resources 165 (FIG. 1) in transit to one or more clientdevices 120 (FIG. 1) from one or more email services 1202 (FIG. 12). Inone embodiment, the access control service 174 may be configured toproxy all data transmitted between the email services 1202 and theclient devices 120. For example, the access control service 174 mayidentify the email resources 165 in transit to the client devices 120via the access control service 174 and may prohibit the email resources165 from proceeding to the client devices 120 as transmitted by theemail services 1202. In another embodiment, the access control service174 may be configured to act as a gateway that controls access to theemail services 1202. For instance, the access control service 174 maytransmit instructions to the email services 1202 that specify that emailresources 165 intended for the client devices 120 must be transmitted tothe client devices 120 via the access control service 174.

Next, in step 1304, the access control service 174 may remove one ormore email attachments from the email resources 165. In certainembodiments, one or more resource rules 171 (FIG. 1) may specify thatall email attachments to the email resources 165 must be stripped and/orremoved from the email resources 165 before the client devices 120 areprovided with access to the email resources 165. In one embodiment, theaccess control service 174 may be configured to copy the emailattachments from the email resources 165 and delete the original emailattachments from the email resources 165. In another embodiment, theaccess control service 174 may be configured to store the removed emailattachments. For instance, the access control service 174 may store theremoved email attachments in the data store 153 (FIG. 1) of the accesscontrol server 150.

Then, in step 1306, the access control service 174 may encode the emailattachments based at least in part on one or more cryptographic keys. Incertain embodiments, one or more resource rules 171 may specify thatemail attachments to the email resources 165 must be encoded based atleast in part on the cryptographic keys before the client devices 120are provided with access to the email resources 165. In someembodiments, the resource rules 171 may specify a required and/orpermitted cryptographic key length for the cryptographic key used toencode the email attachments. In one embodiment, the access controlservice 174 may encode the email attachments with the advancedencryption standard (AES) algorithm. In another embodiment, the accesscontrol service 174 may encode the email attachments with the dataencryption standard (DES) algorithm. In any instance, the access controlservice 174 may encode the email attachments in manner which protectsthe email attachments from being intercepted and accessed by obfuscatingthe data of the email attachments based at least in part on thecryptographic keys.

Furthermore, in step 1308, the access control service 174 may authorizethe client devices 120 to access the email resources 165. In oneembodiment, the access control service 174 may be configured to transmitone or more email resources 165 to the client devices 120. For example,the access control service 174 may transmit the email resources 165 withremoved email attachments to the client devices 120. In anotherembodiment, the access control service 174 may be configured to transmitthe removed email attachments to the client devices 120. For instance,the access control service 174 may transmit email attachments stored inone or more data stores 153 of the access control server 150 to theclient devices 120. In yet another embodiment, the access controlservice 174 may be configured to transmit one or more encoded emailattachments and the associated cryptographic keys to one or more clientside application 126 of the client devices 120. In yet a furtherembodiment, the access control service 174 may be configured to transmitinstructions to the email services 1202 that specify that the emailresources 165, the removed email attachments, and/or the encoded emailattachments should be transmitted to the client devices 120.

FIG. 14 depicts certain illustrative components for a networkedenvironment 1400 according to various embodiments. In certainembodiments, the networked environment 100 may include one or morenetworks 110, one or more client devices 120, an access control service174, and one or more email services 1202. The networked environment 1400may be similar to the networked environment 1200 in FIG. 12. While thenetworked environment 1200 may include the same components as thenetworked environment 1400, the organization of the components of thetwo networked environment may differ. In particular, the email services1202 in the networked environment 1400 may communicate directly with theclient devices 120, whereas the access control service 174 in thenetworked environment 1200 must relay all communications between theemail services 1202 and client devices 120. The access control service174 of the networked environment 1400 may be configured to determinewhich email resources 165 associated with the email services 1202 may beaccessed by the client devices 120, control the manner in which theclient devices 120 are authorized to access the email resources 165, andmay provide the client devices 120 with access to the email resources165.

In certain embodiments, the access control service 174 may determinewhich email resources 165 associated with the email services 1202 may beaccessed by the client devices 120 by configuring the email services1202. In some embodiments, the access control service 174 may transmitone or more instructions to the email services 1202 that configure thefunctionality of the email services 1202. As an example, the accesscontrol service 174 may utilize an instruction protocol, such asMicrosoft PowerShell, to transmit the instructions to an email service1202, such as Microsoft Exchange. In one embodiment, the instructionsmay represent and/or specify one or more resource rules 171 (FIG. 1)that must be satisfied in order to provide the client devices 120 withaccess to the email resources 165. The resource rules 171 may, forexample, specify that all email attachments to the email resources 165must be removed from the email resources 165 before the email resources165 may be provided to the client devices 120. The resource rules 171may further specify that the removed email attachments must betransmitted to the access control service 174.

Additionally, in certain embodiments, the access control service 174 maycontrol the manner in which the client devices 120 are authorized toaccess the email resources 165 by configuring the email resources 165before they are provided to the client devices 120. In some embodiments,the access control service 174 may configure one or more emailattachments removed and/or stripped from one or more email resources165, which may have been transmitted to the access control service 174by the email services 1202. In one embodiment, the access controlservice 174 may configure the email attachments by modifying the emailattachments according to one or more resource rules 171. The resourcerules 171 may, for example, specify that the email attachments must beencoded based at least in part on one or more cryptographic keys beforethe email attachments are provided to the client devices 120. Theresource rules 171 may further specify that the email attachments mustbe configured to be exclusively accessible via one or more client sideapplications 126 on the client devices 120 before the email attachmentsare provided to the client devices 120.

Furthermore, in certain embodiments, the access control service 174 mayprovide the client devices 120 with access to the email resources 165 byauthorizing the client devices for access to the email resources 165. Insome embodiments, the access control service 174 may tailor theauthorization of the client devices 120 in accordance with one or moreresource rules 171. For instance, the resource rules 171 may specifythat the email resources 165 may only be transmitted to the clientdevices 120 over a secure connection, such as over an HTTPS/SSLconnection. In one embodiment, the access control service 174 maytransmit instructions to the email services 1202 that specify that theemail services 1202 may transmit email resources 165 with removed emailattachments to the client devices 120. In another embodiment, the accesscontrol service 174 may transmit the email attachments, which have beenremoved from the email resources 165 by the email services 1202, encodedbased at least in part on one or more cryptographic keys by the accesscontrol service 174, and configured to be exclusively accessible via oneor more client side applications 126 on the client devices 120, to theclient devices 120. In yet another embodiment, the access controlservice 174 may transmit one or more cryptographic keys capable ofdecoding the encoded email attachments to one or more client sideapplications 126 on the client devices 120.

FIG. 15 is a flowchart illustrating exemplary functionality performed byan access control service 174 executed by an access control server 150(FIG. 1) according to certain embodiments. It is understood that theflowchart of FIG. 15 provides merely an example of the many differenttypes of functional arrangements that may be employed to implement theoperation of the access control service 174 as described herein. As analternative, the flowchart of FIG. 15 may be viewed as depicting anexample of steps of a method implemented in the access control server150 according to one or more embodiments.

Beginning with step 1502, the access control service 174 may identifyone or more email resources 165 (FIG. 1) that are associated with one ormore client devices 120 (FIG. 1). In certain embodiments, the accesscontrol service 174 may identify the email resources 165 by receivingthe email resources 165 from an email service 1202 associated with theemail resources 165. For example, the access control service 174 mayreceive the email resources 165 from a Microsoft Exchange email service.In one embodiment, the access control service 174 may proxy emailresources 165 in transit to the client devices 120 from one or moreemail services 1202 (FIG. 14). For example, the access control service174 may proxy email resources 165 transmitted between the email service1202 and the client devices 120 and may filter certain email resources165. In another embodiment, the access control service 174 may transmitinstructions to the email services 1202 that specify that the emailresources 165 must be transmitted to the access control service 174,rather than the client devices 120. In yet another embodiment, theaccess control service 174 may transmit instructions to the emailservices 1202 that specify one or more resource rules 171 (FIG. 1) thatmust be satisfied in order for the client devices 120 to be authorizedto access the email resources 165. For example, the access controlservice 174 may instruct the email services 1202 that email attachmentsto the email resources 165 must be removed from the email resources 165and the access control service 174 may subsequently fetch then emailattachments, in accordance with the resource rules 171.

Next, in step 1504, the access control service 174 may modify one ormore portions of the email resources 165. In certain embodiments, theaccess control service 174 may modify portions of email resources 165received from an email service 1202. In some embodiments, the accesscontrol service 174 may modify portions of the email resources 165 inaccordance with one or more resource rules 171 that must be satisfiedfor the client devices 120 to be authorized to access the emailresources 165. In one embodiment, the access control service 174 mayremove and/or strip one or more email attachments to the email resources165 from the email resources 165. In another embodiment, the accesscontrol service 174 may encode one or more email attachments to theemail resources 165 based at least in part on one or more cryptographickeys.

Then, in step 1506, the access control service 174 may authorize theclient devices 120 to access the email resources 165. In certainembodiments, the access control service 174 may be configured totransmit the email resources 165 to the client devices 120. In oneembodiment, the access control service 174 may transmit email resources165 with removed email attachments to the client devices 120. In anotherembodiment, the access control service 174 may transmit the emailattachments removed from the email resources 165 to the client devices120. In yet another embodiment, the access control service 174 maytransmit one or more encoded email attachments and the associatedcryptographic keys to one or more client side applications 126 on theclient devices 120. In yet a further embodiment, the access controlservice 174 may transmit instructions to the email services 1202 thatspecify that the email resources 165, the removed email attachments,and/or the encoded email attachments should be transmitted to the clientdevices 120.

FIG. 16 is a flowchart illustrating exemplary functionality performed byone or more client side applications 126 executed by one or more clientdevices 120 (FIG. 1) according to certain embodiments. It is understoodthat the flowchart of FIG. 16 provides merely an example of the manydifferent types of functional arrangements that may be employed toimplement the operation of the client side application 126 as describedherein. As an alternative, the flowchart of FIG. 16 may be viewed asdepicting an example of steps of a method implemented in the clientdevice 120 according to one or more embodiments.

Beginning with step 1602, a client device 120 identifies one or moreencoded email resources 165 (FIG. 1). In certain embodiments, the clientdevice 120 may identify encoded email resources 165 by querying one ormore data stores 122 (FIG. 1) of the client device 120 to determinewhether the data stores 122 hold encoded email resources 165. In someembodiments, the client device 120 may identify encoded email resources165 by receiving the encoded email resources 165 on the client device120. In one embodiment, the client device 120 may receive the encodedemail resources 165 on the client device 120 from one or more emailservices 1202 (FIGS. 12 and 14). In another embodiment, the clientdevice 120 may receive the encoded email resources 165 on the clientdevice 120 from an access control service 174.

Next, in step 1604, the client device 120 identifies one or morecryptographic keys associated with the encoded email resources 165. Incertain embodiments, the client device 120 may identify thecryptographic keys associated with the encoded email resources 165 byquerying the data stores 122 of the client device 120 to determinewhether the data stores 122 hold cryptographic keys associated with theencoded email resources 165. In some embodiments, the client device 120may identify cryptographic keys associated with the encoded emailresources 165 by receiving the cryptographic keys associated with theencoded email resources 165 on the client device 120. In one embodiment,the client device 120 may receive the cryptographic keys associated withthe encoded email resources 165 from an access control service 174. Inanother embodiment, the client device 120 may receive the cryptographickeys associated with the encoded email resources 165 from an emailservice 1202.

Then, in step 1606, the client device 120 decodes the encoded emailresources 165 based at least in part on the cryptographic keysassociated with the encoded email resources 165. In certain embodiments,the client side applications 126 on the client device 120 may decode theencoded email resources 165 based at least in part on the cryptographickeys associated with the encoded email resources 165. In someembodiments, the client side application 126 may render and/or presentthe decoded email resources 165 on a user interface 137 (FIG. 1)executed on a display 136 (FIG. 1) of the client device 120.

FIG. 17 shows schematic block diagrams of an exemplary access controlserver 150 and an exemplary client device 120 according to an embodimentof the present disclosure. The access control server 150 includes atleast one processor circuit, for example, having a processor 1703 and amemory 1706, both of which are coupled to a local interface 1709. Tothis end, the access control server 150 may comprise, for example, atleast one server computer or like device. Similarly, the client device120 includes at least one processor circuit, for example, having aprocessor 1753 and a memory 1756, both of which are coupled to a localinterface 1759. Additionally, the client device 120 may be in datacommunication with a display 136 for rendering user interfaces 137(FIG. 1) and one or more other I/O devices 1763 for inputting andoutputting data. To this end, the client device 120 may comprise, forexample, at least one client computer or like device.

The following is a general discussion of the components of the accesscontrol server 150 and the client device 120. The local interface 1709and 1759 may comprise, for example, a data bus with an accompanyingaddress/control bus or other bus structure as can be appreciated. Storedin the memory 1706 and 1756 are both data and several components thatare executable by the processors 1703 and 1753. In particular, withregard to the access control server 150, stored in the memory 1706 andexecutable by the processor 1703 are an access control service 174 andpotentially other applications. Additionally, with regard to the clientdevice 120, stored in the memory 1756 and executable by the processor1753 are a client side application 126 and potentially otherapplications. Also stored in the memory 1706 and 1756 may be a datastore 153 and 122 and other data. In addition, an operating system maybe stored in the memory 1706 and 1756 and executable by the processor1703 and 1753.

It is to be understood that there may be other applications that arestored in the memory 1706 and 1756 and are executable by the processor1703 and 1753 as can be appreciated. Where any component discussedherein is implemented in the form of software, any one of a number ofprogramming languages may be employed such as, for example, C, C++, C#,Objective C, Java, JavaScript, Perl, PHP, Visual Basic, Python, Ruby,Delphi, Flash, or other programming languages.

A number of software components are stored in the memory 1706 and 1756and are executable by the processor 1703 and 1753. In this respect, theterm “executable” means a program file that is in a form that canultimately be run by the processor 1703 and 1753. Examples of executableprograms may be, for example, a compiled program that can be translatedinto machine code in a format that can be loaded into a random accessportion of the memory 1706 and 1756 and run by the processor 1703 and1753, source code that may be expressed in proper format such as objectcode that is capable of being loaded into a random access portion of thememory 1706 and 1756 and executed by the processor 1703 and 1753, orsource code that may be interpreted by another executable program togenerate instructions in a random access portion of the memory 1706 and1756 to be executed by the processor 1703 and 1753, etc. An executableprogram may be stored in any portion or component of the memory 1706 and1756 including, for example, random access memory (RAM), read-onlymemory (ROM), hard drive, solid-state drive, USB flash drive, memorycard, optical disc such as compact disc (CD) or digital versatile disc(DVD), floppy disk, magnetic tape, or other memory components.

The memory 1706 and 1756 are defined herein as including both volatileand nonvolatile memory and data storage components. Volatile componentsare those that do not retain data values upon loss of power. Nonvolatilecomponents are those that retain data upon a loss of power. Thus, thememory 1706 and 1756 may comprise, for example, random access memory(RAM), read-only memory (ROM), hard disk drives, solid-state drives, USBflash drives, memory cards accessed via a memory card reader, floppydisks accessed via an associated floppy disk drive, optical discsaccessed via an optical disc drive, magnetic tapes accessed via anappropriate tape drive, and/or other memory components, or a combinationof any two or more of these memory components. In addition, the RAM maycomprise, for example, static random access memory (SRAM), dynamicrandom access memory (DRAM), or magnetic random access memory (MRAM) andother such devices. The ROM may comprise, for example, a programmableread-only memory (PROM), an erasable programmable read-only memory(EPROM), an electrically erasable programmable read-only memory(EEPROM), or other like memory device.

Also, the processor 1703 and 1753 may represent multiple processors, andthe memory 1706 and 1756 may represent multiple memories that operate inparallel processing circuits, respectively. In such a case, the localinterface 1709 and 1759 may be an appropriate network 110 (FIG. 1) thatfacilitates communication between any two of the multiple processors1703 and 1753, or between any two of the memory 1706 and 1756, etc. Thelocal interface 1709 and 1759 may comprise additional systems designedto coordinate this communication, including, for example, performingload balancing. The processor 1703 and 1753 may be of electrical or ofsome other available construction.

Although the access control service 174, client side application 126,and other various systems described herein may be embodied in softwareor code executed by general purpose hardware as discussed above, as analternative the same may also be embodied in dedicated hardware or acombination of software/general purpose hardware and dedicated hardware.If embodied in dedicated hardware, each can be implemented as a circuitor state machine that employs any one of or a combination of a number oftechnologies. These technologies may include, but are not limited to,discrete logic circuits having logic gates for implementing variouslogic functions upon an application of one or more data signals,application specific integrated circuits having appropriate logic gates,or other components, etc. Such technologies are generally well known bythose skilled in the art and, consequently, are not described in detailherein.

The flowcharts of FIGS. 2, 3, 13 and 15 show certain functionality andoperations performed by the access control service 174 and client sideapplication 126, respectively. If embodied in software, each box mayrepresent a module, segment, or portion of code that comprises programinstructions to implement the specified logical function(s). The programinstructions may be embodied in the form of source code that compriseshuman-readable statements written in a programming language or machinecode that comprises numerical instructions recognizable by a suitableexecution system such as a processor 1703 and 1753 in a computer systemor other system. The machine code may be converted from the source code,etc. If embodied in hardware, each block may represent a circuit or anumber of interconnected circuits to implement the specified logicalfunction(s).

Although the flowcharts of FIGS. 2, 3, 13 and 15 show a specific orderof execution, it is understood that the order of execution may differfrom that which is depicted. For example, the order of execution of twoor more steps may be scrambled relative to the order shown. Also, two ormore blocks shown in succession in FIGS. 2, 3, 13 and 15 may be executedconcurrently or with partial concurrence. Further, in some embodiments,one or more of the steps shown in FIGS. 2, 3, 13 and 15 may be skippedor omitted. In addition, any number of counters, state variables,warning semaphores, or messages might be added to the logical flowdescribed herein, for purposes of enhanced utility, accounting,performance measurement, or providing troubleshooting aids, etc. It isunderstood that all such variations are within the scope of the presentdisclosure.

Also, any logic or application described herein, including the accesscontrol service 174 and the client side application 126, that comprisessoftware or code can be embodied in any non-transitory computer-readablemedium for use by or in connection with an instruction execution systemsuch as, for example, a processor 1703 and 1753 in a computer system orother system. In this sense, the logic may comprise, for example,statements including instructions and declarations that can be fetchedfrom the computer-readable medium and executed by the instructionexecution system. In the context of the present disclosure, a“computer-readable medium” can be any medium that can contain, store, ormaintain the logic or application described herein for use by or inconnection with the instruction execution system. The computer-readablemedium can comprise any one of many physical media such as, for example,magnetic, optical, or semiconductor media. More specific examples of asuitable computer-readable medium would include, but are not limited to,magnetic tapes, magnetic floppy diskettes, magnetic hard drives, memorycards, solid-state drives, USB flash drives, or optical discs. Also, thecomputer-readable medium may be a random access memory (RAM) including,for example, static random access memory (SRAM) and dynamic randomaccess memory (DRAM), or magnetic random access memory (MRAM). Inaddition, the computer-readable medium may be a read-only memory (ROM),a programmable read-only memory (PROM), an erasable programmableread-only memory (EPROM), an electrically erasable programmableread-only memory (EEPROM), or other type of memory device.

It should be emphasized that the above-described embodiments of thepresent disclosure are merely possible examples of implementations setforth for a clear understanding of the principles of the disclosure.Many variations and modifications may be made to the above-describedembodiment(s) without departing substantially from the spirit andprinciples of the disclosure. All such modifications and variations areintended to be included herein within the scope of this disclosure andprotected by the following claims.

The claimed invention is:
 1. A method for controlling access to emailattachments, comprising: providing a graphical user interface (GUI) thatenables selection of at least one rule to govern email access for aplurality of users; receiving, through the GUI, a selection of a removalrule that requires removing at least one attachment to an email; andenforcing the selected removal rule by removing the at least one emailattachment, without interaction by a user sending the email.
 2. Themethod of claim 1, further comprising: enabling selection of a usergroup at the GUI, wherein the user group is a subset of the plurality ofusers; receiving, through the GUI, a selection of the user groupassociated with the removal rule; and enforcing the selected removalrule on the selected user group.
 3. The method of claim 1, wherein theGUI enables selection of a storage location for the removal rule.
 4. Themethod of claim 1, wherein the GUI enables selection of an effectivedate or an expiration date for the removal rule.
 5. The method of claim1, further comprising: receiving, through the GUI, a selection of anencryption rule that requires encrypting at least one attachment to theemail; and enforcing the selected encryption rule by encrypting the atleast one email attachment, without interaction by the user sending theemail.
 6. The method of claim 5, wherein enforcing the selectedencryption rule comprises encrypting the at least one email attachmentwith a cryptographic key accessible to a secure container applicationseparate from an email application used to send or retrieve the email.7. The method of claim 6, wherein enforcing the selected encryption rulecomprises providing a key used to decrypt the encrypted email attachmentonly to the secure container application.
 8. A non-transitory,computer-readable medium embodying a program executable in at least onecomputing device, comprising code that, when executed by the computingdevice, performs stages for controlling access to email attachments, thestages comprising: providing a graphical user interface (GUI) thatenables selection of at least one rule to govern email access for aplurality of users; receiving, through the GUI, a selection of a removalrule that requires removing at least one attachment to an email; andenforcing the selected removal rule by removing the at least one emailattachment, without interaction by a user sending the email.
 9. Thenon-transitory, computer-readable medium of claim 8, the stages furthercomprising: enabling selection of a user group at the GUI, wherein theuser group is a subset of the plurality of users; receiving, through theGUI, a selection of the user group associated with the removal rule; andenforcing the selected removal rule on the selected user group.
 10. Thenon-transitory, computer-readable medium of claim 8, wherein the GUIenables selection of a storage location for the removal rule.
 11. Thenon-transitory, computer-readable medium of claim 8, wherein the GUIenables selection of an effective date or an expiration date for theremoval rule.
 12. The non-transitory, computer-readable medium of claim8, the stages further comprising: receiving, through the GUI, aselection of an encryption rule that requires encrypting at least oneattachment to the email; and enforcing the selected encryption rule byencrypting the at least one email attachment, without interaction by theuser sending the email.
 13. The non-transitory, computer-readable mediumof claim 12, wherein enforcing the selected encryption rule comprisesencrypting the at least one email attachment with a cryptographic keyaccessible to a secure container application separate from an emailapplication used to send or retrieve the email.
 14. The non-transitory,computer-readable medium of claim 13, wherein enforcing the selectedencryption rule comprises providing a key used to decrypt the encryptedemail attachment only to the secure container application.
 15. A systemfor controlling access to email attachments, comprising: a processorthat generates a graphical user interface (GUI) that enables selectionof at least one rule to govern email access for a plurality of users;and an access control server communicatively coupled to the processorand configured to receive selections provided through the GUI, whereinthe GUI receives a selection of a removal rule that requires removing atleast one attachment to an email, and wherein the access control serverenforces the selected removal rule by removing the at least one emailattachment, without interaction by a user sending the email.
 16. Thesystem of claim 15, wherein the GUI enables and receives selection of auser group that is a subset of the plurality of users, and wherein theaccess control server enforces the selected removal rule on the selecteduser group.
 17. The system of claim 15, wherein the GUI enablesselection of at least one of a storage location, effective dates, and anexpiration date for the removal rule.
 18. The system of claim 15,wherein the GUI receives a selection of an encryption rule that requiresencrypting at least one attachment to the email, and wherein the accesscontrol server enforces the selected encryption rule by encrypting theat least one email attachment, without interaction by the user sendingthe email.
 19. The system of claim 18, wherein enforcing the selectedencryption rule comprises encrypting the at least one email attachmentwith a cryptographic key accessible to a secure container applicationseparate from an email application used to send or retrieve the email.20. The system of claim 19, wherein enforcing the selected encryptionrule comprises providing a key used to decrypt the encrypted emailattachment only to the secure container application.